Overview

overview

10

Static

static

10

2884-65-0x...ry.exe

windows7-x64

1

2884-65-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2884-65-0x0000000000400000-0x000000000042F000-memory.dmp

  • Size

    188KB

  • MD5

    6b94aa2047602f6161e1a7784721e98b

  • SHA1

    aab938b511612b8c09bd83f4bf2ed241230c17c7

  • SHA256

    68010df1e4feafc42863ee714b65aa783673ca4e2268726074eb10891afbf88e

  • SHA512

    02a1cc619a9530e2d655901f0270e7ab711936791dc8b774d2e9678fff7de5cc0b9f3f1e07c5de3cac4427e37bc7b47a88b79ccfee938580b0bbbdf46982cf00

  • SSDEEP

    3072:GKZEMG0p44wC36yhKmxuVq2Sn1POG/US8ETENQgj++PWPs98vYfKxq5HMQdN4:rE06CKmxwq2Sn1POk4NQsWU98vEwqLz

Score
10/10
ratfg01formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fg01

Decoy

kohzyzb.xyz

freehdonlineporn.xyz

fitflextr.com

jinxiu3.top

malditabelleza.online

shopfloraflair.com

dohrolling.com

newadvice4u.com

beerexperiment.com

kppjmmrp.cfd

precinctautomotors.com

energia-online.net

mountaingoodnessrewards.site

ibexpertmasterkey.com

rzunirnk.cfd

mblhzbno.cfd

n-g.vip

mintakacom.store

fnpdhhdx.cfd

zenfulgoods.com

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2884-65-0x0000000000400000-0x000000000042F000-memory.dmp
    .exe windows x86


    Headers

    Sections